Notifier

The notifier (filter/notify/notifyd.py) runs in its own container on port 8093. Every 15 seconds it reads the filter API, as Family Filter for Mac does, and pushes anything new to every registered iPhone running Family Filter for iPhone, through Apple’s push service (APNs).

What it pushes

• “I’m done” and “Ask for more time” presses.
• The filter switched off, for everything or for one device.
• The filter not answering, so the watchdog has let the child’s devices through unfiltered, and when it’s back. This is read from the watchdog’s own file, not the API, so it works with the filter down.
• A device that seems to have removed the filter’s certificate.
• A device at home with its VPN off.

Nothing is pushed for what was already there when it starts. A push that doesn’t reach every phone is retried for up to 6 hours.

Phones

Phones register themselves from the app (Settings ▸ Notifications) with their own filter token. Once that token is removed, the phone gets no more pushes. A phone Apple says is gone is dropped.

Route
GET /api/notify/health	No token: {ok, devices, apns}
POST /api/notify/devices {token, name, sandbox}	Register this phone
DELETE /api/notify/devices/<token>	Stop pushing to it
POST /api/notify/test {token}	Push a test to that phone

The Apple push key

Made at developer.apple.com ▸ Keys ▸ Apple Push Notifications service. It’s kept in the repo encrypted, and filter/scripts/notify-install.sh --env installs it on the Firewalla without writing it to disk on the Mac.

Builds from Xcode get pushes from Apple’s sandbox; TestFlight and App Store builds get them from production. The app tells the notifier which.

Source: filter/notify/notifyd.py, filter/README.md